Files being quarantined even though exceptions are set
Article ID: 174705
Updated On:
Products
Issue/Introduction
Endpoint Protection 14 or above detects suspected non-malicious files even though exceptions/exclusions are in place. The files are being detected as heuristic and detected as AdvML.A, AdvML.B or similar.
Resolution
First, ensure that exceptions/exclusions have been applied correctly for Auto-Protect.
In the Virus and Spyware Protection policy under Global Scan Options, ensure that Bloodhound is configured as Automatic and not Aggressive.
Also ensure that the endpoints have reliable, robust connectivity to online Reputation servers. If this is not present, an increased number of False Positives can be expected from the Advanced Machine Learning component introduced in SEP 14.
For further troubleshooting see the following articles:
- How does Symantec Endpoint Protection use advanced machine learning?
- Best Practice when Symantec Endpoint Protection is Detecting a File that is Believed to be Safe
For detections on internally developed applications:
If detections continue, collect 6 to 9 samples of the files being detected as AdvML and submit them by choosing to the 'Clean Software Incorrectly Detected' tile at https://symsubmit.symantec.com/ Provide these to your Technical Support contact. Engineers will examine the files and develop an solution if possible.
Feedback
